'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Reset MFA for a Blocked Global Administrator Account in Entra ID
Question details
The user is unable to access Microsoft Entra ID because their sole Global Administrator account is blocked by multifactor authentication.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Attempting to sign in to the administrative portal but failing the multifactor authentication process, resulting in a lockout.
- Observed behavior
- The global administrator developer account is entirely blocked by MFA, preventing any administrative access to the tenant.
Check with your IT team or tenant settings to determine if there is another active Global Administrator account available, as having a secondary admin dictates the recovery path.
Contact Microsoft Support for Account Recovery
Use this method if the blocked account is the only Global Administrator in your Microsoft Entra ID tenant.
When a single Global Administrator is locked out, no other user in the organization has the permissions to reset the MFA settings. You must escalate the issue to Microsoft's Data Protection team for identity verification and manual recovery.
Find and call the official Microsoft Customer Service phone number for your specific region or country.
When navigating the automated phone system, state that you are experiencing an 'admin account lockout' and explicitly ask to be transferred to the Data Protection team.
If phone support is unavailable, create a temporary Microsoft 365 trial tenant, sign in as the trial admin, and use the 'Help & Support' widget in the Microsoft 365 admin center to open a support request for your locked tenant.
Reset Authentication via Another Global Administrator
Apply this solution if your organization has a secondary or backup Global Administrator account that can still log in.
Need a Reliable Office Suite While Dealing with Admin Lockouts?
While you wait for Microsoft Support to recover your admin access, you can continue your daily work without interruption. WPS Office is a highly compatible, free, and lightweight alternative to Microsoft Office that does not require complex cloud identity administration.
- 1. Download the Installer: Visit the WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the installer and follow the on-screen prompts to complete the setup in minutes.
- 3. Open Your Documents: Launch WPS Office and open your existing .docx, .xlsx, or .pptx files to resume working immediately.
Frequently Asked Questions
How can I prevent my Global Administrator account from being locked out in the future?
You should create at least two 'break-glass' or emergency access accounts in Microsoft Entra ID. These accounts should have Global Administrator privileges, use a complex password, and be explicitly excluded from Conditional Access policies requiring MFA.
How long does the Microsoft Data Protection team take to recover an account?
Account recovery by the Data Protection team can take anywhere from a few days to several weeks. This extended timeframe is necessary because they must perform stringent security checks and manual verification to confirm your identity and tenant ownership.
Can I use Microsoft Authenticator without a network connection to pass MFA?
Yes, if your account was previously added to the Microsoft Authenticator app, you can open the app and use the 6-digit time-based one-time passcode (TOTP) generated for your account, even if your mobile device is currently offline.
Why did my Global Administrator account get blocked?
Admin accounts can be blocked due to multiple consecutive failed MFA attempts, suspicious login activities detected by Microsoft's risk engine, or stringent Conditional Access policies that trigger an automatic security lockout.
